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MEMORANDUM FOR: Chairman, Computer Security Subcommittee 


SUBJECT: User Authentication Device for Computer 
Terminals 


PROM: ire ee Sees real STAT 
Staff, DCI Security Committee 


1. I have reviewed the above subject and recommend 
the Computer Security Subcommittee move in the direction 
as suggested in the last paragraph of this memorandum. 


2. Considerable effort has gone into studying the 
application of various personnel identification or veri- 
fication devices for application to security problems. 
This activity was accomplished, and continues to some 
degree at the following facilities: 


a. Air Force/Mitre (ESD) at Hanscomb Field, 
Massachusetts under the Base Installation 
Security Study. (BISS) 


b. National Bureau of Standards focal point - 
Helen Wood. 


c. AEC/NRA - Sandia Corporation, Albuquerque, 
New Mexico 


d. CIA - (TRW Badge Machine) 
Local point - Office of Security 


3, The activity of the above first three facilities 
has been documented and reports are available. The type 
of devices studied are: 


voice identification/verification 

finger print identification/verification 

visual identification/verification 

badge identification/verification 

Signature identification/verification 

password identification/verification 

other personal characteristics 
identification/verification 
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The CIA activity, to the undersigned's knowledge, has not 
resulted in documentation or reports. This activity, however, 
is attempting to keep current in the overall aspects of 
identification/authentication/verification of personnel. 


4, It was suggested at the last Subcommittee meeting 
that the R&D Subcommittee of SECOM be tasked to explore the 
"user authentication device for terminals" area. The 
undersigned believes that a more definitive request should 
be presented to the R&D Subcommittee, due to the past work 
by others in this area. This definitive request should be 
based on the desires of the members of Computer Security 
Subcommittee for a type of device with a description of 
the application and security controls expected. 


9. It is suggested that the Chair of the Computer 
Security Subcommittee create a working group to describe 
the security controls and type of devices acceptable to 
the IC for the R&D Subcommittee. 
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